Skip to content

Reconcile 17 delivered tracker items and preserve certification blocker #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
unbraind merged 5 commits into from
Oct 22, 2026
Merged

Reconcile 17 delivered tracker items and preserve certification blocker #139

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f91f5c1
chore: reconcile 18 audited tracker items
unbraind Oct 21, 2026
5cc231b
chore: refresh tracker reconciliation self-host snapshot
unbraind Oct 21, 2026
7d4fc75
chore: record self-host verification and refresh final receipts
unbraind Oct 21, 2026
a1e4d77
Align tracker blockers and retained delivery evidence
unbraind Oct 22, 2026
6edd8f3
Merge main and refresh tracker reconciliation evidence
unbraind Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions .agents/pm/chores/pm-vcs-3dxi.toon
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,20 +2,26 @@ id: pm-vcs-3dxi
title: Enable the gated pm-github issue sync and remove the braces chain
description: "Adopt the pinned reusable issue-sync caller and preserve the existing CI workflow_dispatch trigger. Related adoption task: pm-github-aiok. Refresh the exact published pm-ops pin and remove unused fast-glob, addressing existing dependency issue pm-vcs-qfku. Record the Node 22 retention flake separately; regenerate the self-host bundle after tracker/changelog writes and staged new files, commit, then verify at HEAD. Never execute the sync or change repository settings."
type: Chore
status: in_progress
status: closed
priority: 2
tags[1]: changed
created_at: "2026-10-15T07:41:09.216Z"
updated_at: "2026-10-15T12:26:55.056Z"
updated_at: "2026-10-21T19:10:16.745Z"
closed_at: "2026-10-21T19:10:12.252Z"
completed_at: "2026-10-21T19:10:12.252Z"
author: codex-agent
comments[7]{created_at,author,text}:
resolution: Delivered by the audit-linked mainline implementation.
expected_result: Enable the gated pm-github issue sync and remove the braces chain.
actual_result: "Re-verified unchanged main 27e1d84671fa: .github/workflows/pm-github-sync.yml retain immutable reusable-workflow pins; runtime scheduled-job success is outside this closure."
comments[8]{created_at,author,text}:
"2026-10-15T07:42:22.476Z",codex-agent,"Baseline npm ls braces fast-glob micromatch shows fast-glob 3.3.3 -> micromatch 4.0.8 -> braces 3.0.3, also the optional peer of pm-ops 2026.10.6. Production-only tree is empty. The production duplication launcher and raw coverage inventory already use node:fs globSync; fast-glob has no direct code import. Refresh pm-ops to latest published 2026.10.14 and remove the direct peer. CI already has workflow_dispatch; use the prescribed pm-github 2026.10.14 fallback pending release and repin. No sync execution or repository settings changes."
"2026-10-15T07:49:21.519Z",codex-agent,"Related work: pm-vcs-qfku tracks the removed vulnerable dependency chain; pm-vcs-1bcq records the reproduced Node 22 GC measurement race and one-flag deterministic test fix with flag-only revert and held-corpus negative controls. The fallback reusable workflow predates caller-changelog regeneration and CI dispatch from pm-github PR 122; the later 2026.10.15 repin remains an operational dependency."
"2026-10-15T07:49:51.061Z",codex-agent,"PM-linked validation passes: npm run typecheck; npm run duplicates (65 sources, 0 clone pairs); retained-corpus focused test 1/1. The one-flag measurement fix has a flag-removal failing revert and a genuinely retained corpus failing control. Preparing the committed self-host snapshot before full isolated npm and Bun release gates. Both workflow/dependency changes preserve runtime code and quality thresholds."
"2026-10-15T08:43:47.843Z",codex-agent,The first isolated npm attempt caught the pre-existing copied prepare launcher no longer matching the newly published pm-ops 2026.10.14 template; stopped that failed attempt and preserved its output. Refreshed only from the installed published template. Its new artifact guard skips package resolution and merge-driver configuration during npm pack/publish. Added two real-checkout regressions covering both commands with pinned and stale pm-ops. The complete focused launcher suite passes 10/10. Revert proof and final committed-head full gates follow; the npm/Bun thresholds remain unchanged.
"2026-10-15T08:45:36.516Z",codex-agent,"Launcher behavioural revert proof: retain both new regression tests and restore ONLY scripts/prepare-merge-driver.ts from the pre-upgrade source. Both npm pack and npm publish scenarios fail (0/2) on a stale package export before the intended skip. Restoring the exact published pm-ops 2026.10.14 template passes the full launcher suite 10/10 with zero skips. The real Git-config invariants and dependency-resolution assertions remain intact. No unmerged template was copied."
"2026-10-15T09:47:24.296Z",codex-agent,"Final committed-source gates at 90ba1c0 PASS: isolated Node 26.7.0 npm run release:check and bun run release:check each pass 1536/1536 tests, zero failures/skips/cancellations. All 65 authored sources meet unchanged per-file 100% statements/lines/branches/functions: 22488/22488 statements and lines, 759/759 functions, 6532/6532 branches. The 355-declaration docstring gate, zero-duplication gate, native TOON, installed-CLI stat-cache strace, committed self-host equality, production audit, identity audit, package dry-run, changelog and release date/provenance checks all pass. Built and packed Node/Bun consumers pass within the suites. The copied launcher mismatch was introduced by upgrading pm-ops without refreshing its copy; it was corrected with the exact published template, two behavioral regressions, 0/2 old-launcher revert failures and 10/10 restored passes. The target launcher alone also has 100% coverage in all four dimensions. No SDK pin, thresholds or existing histories were changed. Final tracker receipts and claim releases will regenerate the snapshot before final HEAD checks."
"2026-10-15T09:49:03.520Z",codex-agent,"Receipt clarification: the old-launcher revert had zero passing and two failing new artifact regressions; the restored launcher suite had ten passing and zero failing tests. Existing history records were preserved byte-for-byte; tracker changes append new records. All three rollout-related claims are released while the items remain in progress for orchestrator verification."
"2026-10-21T19:09:34.602Z",codex-agent,"Tracker reconciliation authorized for the audited verdict FIXED-STALE. Re-verified unchanged main 27e1d84671fa: .github/workflows/pm-github-sync.yml retain immutable reusable-workflow pins; runtime scheduled-job success is outside this closure. Enable the gated pm-github issue sync and remove the braces chain. The SHA-pinned .github/workflows/pm-github-sync.yml caller is present on main. Toolchain manifests record adopted canonical tooling; later scheduled-job failures are separate from caller adoption. Scope: tracker state only; no new runtime certification or deployment claim."
files[6]{path,scope,note}:
.github/workflows/pm-github-sync.yml,project,Pinned gated workflow caller
package-lock.json,project,Braces-free locked graph
Expand All @@ -28,4 +34,5 @@ tests[1]{command,scope,provenance{author,created_at,source_kind,source_ref}}:
docs[2]{path,scope,note}:
CHANGELOG.md,project,Canonical generated changelog
README.md,project,Built-in globbing dependency documentation
close_reason: "Re-verified unchanged main 27e1d84671fa: .github/workflows/pm-github-sync.yml retain immutable reusable-workflow pins; runtime scheduled-job success is outside this closure. Audit delivery: Enable the gated pm-github issue sync and remove the braces chain. The SHA-pinned .github/workflows/pm-github-sync.yml caller is present on main. Toolchain manifests record adopted canonical tooling; later scheduled-job failures are separate from caller adoption."
body: ""
9 changes: 5 additions & 4 deletions .agents/pm/chores/pm-vcs-bcgs.toon
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,16 +6,16 @@ status: blocked
priority: 2
tags: []
created_at: "2026-09-26T14:12:57.090Z"
updated_at: "2026-10-04T12:36:00.635Z"
updated_at: "2026-10-22T11:56:54.171Z"
author: "harness:codex"
estimated_minutes: 120
acceptance_criteria: "Installed repository-local PM CLI/SDK, pm-changelog and pm-ops equal published 2026.10.4; the committed selfhost.bundle tip tree matches the committed source and full release:check passes at the exact candidate head; packed npm/Bun functional VCS acceptance and strict tracker health pass; review, all-source coverage, and full forge/scale limits are stated independently."
blocked_by: pm-vcs-dispatch104
blocked_reason: Requested workflow_dispatch execution cannot satisfy required PR status checks under current GitHub Docs; owner must select an eligible event path. Required substantive reviews also missing.
actual_result: "Full locked release gate PASS 797/797 zero skips, configured 39-file c8 100/100/100/100; native/stat-cache/committed self-host/audit/identity/pack/changelog/attestation pass. Both audits clean, Bun graph and real tracker npm/native-Bun dogfood pass; strict health and read-only GitHub preview 1/0/0 pass. Acceptance pins corrected in 29710a4. NOT READY: valid CodeRabbit required-check event restriction remains unresolved in pm-vcs-dispatch104; explicit requested workflow_dispatch retained but cannot satisfy required PR check rules. Substantive Sourcery/Cubic reviews quota-limited; Gemini/Copilot absent. No owner publishing change."
blocked_reason: Exact-head certification remains unmet and pm-vcs-dispatch104 is still open; historical delivery ancestry does not establish required PR-check satisfaction or current acceptance.
actual_result: "Re-checked main 27e1d84671fa8c139f7dd00b9e41a7b407319ec7: dated delivery d7e8657758ce remains in ancestry and its workflow regressions remain present. Current toolchain pins have advanced beyond the dated 2026.10.4 receipt. The original acceptance criteria and unresolved pm-vcs-dispatch104 dependency remain in force; this item is blocked, not currently certified."
dependencies[1]{id,kind,created_at,author,source_kind,author_source}:
pm-vcs-dispatch104,blocked_by,"2026-10-04T12:35:57.173Z",codex-sol,"cli:update:blocked_by",detected
comments[10]{created_at,author,text}:
comments[11]{created_at,author,text}:
"2026-09-28T06:20:17.332Z",claude-hub,"2026-09-28: pinned pm-ops 2026.9.28 and re-copied its templates/prepare-merge-driver.ts (pm-ops#124: the omit-dev skip now checks every Node resolution path for an incomplete hoisted pm-ops, so a broken ancestor install fails instead of silently skipping the merge drivers). release:check and changelog:check pass on this branch."
"2026-10-02T21:43:20.112Z",codex-sol,"Restart audit validates CodeRabbit 4169919316: npm.cmd is not executable via shell-free spawnSync. Add red Windows launch assertion and real Node CLI argv fixture, then pack through npm JS entrypoint on Windows. Preserve shell-free arguments and self-host bundle/HEAD equality."
"2026-10-02T21:44:53.397Z",codex-sol,Windows launcher assertion fails against npm.cmd and passes using process.execPath. Added real shell-free Node subprocess fixture verifying a spaced npm entrypoint and destination containing ampersand/percent remain literal argv; fallback entrypoint and POSIX args are covered. Focused PM-linked tests pass. Full locked release gate follows at committed self-host head; all-source CDC scope remains pm-vcs-tj07.
Expand All @@ -26,6 +26,7 @@ comments[10]{created_at,author,text}:
"2026-10-04T12:22:35.726Z",codex-sol,"Full PM-linked gate passed: npx pm test pm-vcs-bcgs --run --only-index 4 --progress --pm-context tracker --override-linked-pm-context, executing flock /tmp/claude-1000/heavy-gate.lock npm run release:check. 797/797 tests, zero skips; c8 100% statements/branches/functions/lines in the unchanged configured inventory. Native TOON, stat-cache, committed self-host, production audit, identities, pack, changelog/date/publish-attestation all pass. Both npm audits clean; CI Bun install --no-save passed. Final review and remote CI remain separate."
"2026-10-04T12:32:05.281Z",codex-sol,"Initial PR #89 Node 22/26 release CI, both Windows launcher checks and CodeQL passed at c88f1cf. Correct stale reused acceptance pins to 2026.10.4 and make linked gate create the mandatory lock parent, following the same valid tracker review correction in pm-ts-starter. Preserve existing whole-source benchmark boundary pm-vcs-tj07. Sourcery weekly and Cubic monthly quota receipts are missing substantive reviews; Gemini/Copilot absent, CodeRabbit running, Greptile pending. Regenerate bundle with evidence and verify committed equality before final push."
"2026-10-04T12:35:58.302Z",codex-sol,"CodeRabbit #89 4177578662 acceptance-version finding is fixed in 29710a4. Finding 4177578664 is valid: current GitHub Docs explicitly exclude workflow_dispatch job checks from required PR check evaluation. Retain the user-mandated GITHUB_TOKEN dispatch, refusing the suggested removal/credential redesign in this certification scope; create pm-vcs-dispatch104 and keep the finding unresolved, not misclassified as wrong. CI execution/name tests remain valid but do not establish branch-rule satisfaction. Publishing unchanged; NOT READY."
"2026-10-21T19:14:38.144Z",codex-agent,"Tracker reconciliation authorized for the audited verdict FIXED-STALE. Re-verified unchanged main 27e1d84671fa: delivery d7e8657758ce remains in main ancestry; .github/workflows/ci.yml, test/dependency-refresh-workflow.test.ts remain present. Certify pm-vcs on PM CLI/SDK 2026.10.4 and consolidate pending dependency updates. [PR #89](https://github.com/unbraind/pm-vcs/pull/89) (d7e8657) delivers the dated certification; package.json/lockfile subsequently advance the toolchain. A dated receipt is not current exact-head acceptance. Scope: tracker state only; no new runtime certification or deployment claim."
notes[5]{created_at,author,text}:
"2026-09-26T14:24:18.713Z","harness:codex","author=codex,text=Installed @unbrained/pm-cli 2026.9.26, pm-changelog 2026.9.25, pm-ops 2026.9.26. Copied the exact pm-ops canonical prepare launcher; regenerated committed selfhost.bundle. Full release:check passed 789/789 tests, 0 skipped, c8 100/100/100/100, native TOON and strace acceptance, self-host source identity, zero production audit findings, npm pack dry run, changelog and attestation gates. Strict PM health passed with an existing advisory provenance warning."
"2026-09-29T13:24:09.460Z",codex,"Fresh npm/npx and Bun/bunx projects installed packed pm-vcs 2026.7.30 with published CLI 2026.9.29. Both package installs reported copy.complete=true and activated the extension; each initialized native pm-vcs, staged and committed a real text file, then passed strict PM health with zero warnings. This was on the code-identical artifact before the local pin edit; exact new-head full gate and committed self-host bundle revalidation follow."
Expand Down
12 changes: 10 additions & 2 deletions .agents/pm/chores/pm-vcs-h67d.toon
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,19 @@ id: pm-vcs-h67d
title: "Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs"
description: "Repin the gated sync caller to pm-github 2026.10.16 (tag 67a5e3e: npm-project-dir input, caller default branch resolved through the API for schedule payloads) and add the reusable gated closeout caller, which opens one reviewed PR per day closing items delivered by merged pull requests."
type: Chore
status: in_progress
status: closed
priority: 2
tags[3]: changed,ci,pm-github
created_at: "2026-10-16T10:42:29.344Z"
updated_at: "2026-10-16T10:42:29.344Z"
updated_at: "2026-10-21T19:02:33.539Z"
closed_at: "2026-10-21T19:02:27.722Z"
completed_at: "2026-10-21T19:02:27.722Z"
author: claude-orchestrator
acceptance_criteria: pm-github-sync.yml pins 2026.10.16 at 67a5e3e; pm-github-closeout.yml calls the reusable closeout workflow at the same pin
resolution: Delivered by the audit-linked mainline implementation.
expected_result: "Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs."
actual_result: "Re-verified unchanged main 27e1d84671fa: .github/workflows/pm-github-sync.yml, .github/workflows/pm-github-closeout.yml retain immutable reusable-workflow pins; runtime scheduled-job success is outside this closure."
comments[1]{created_at,author,text}:
"2026-10-21T19:01:50.387Z",codex-agent,"Tracker reconciliation authorized for the audited verdict FIXED-STALE. Re-verified unchanged main 27e1d84671fa: .github/workflows/pm-github-sync.yml, .github/workflows/pm-github-closeout.yml retain immutable reusable-workflow pins; runtime scheduled-job success is outside this closure. Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs. Both .github/workflows/pm-github-sync.yml and pm-github-closeout.yml pin 67a5e3e / 2026.10.16. Adoption is delivered; this does not claim scheduled jobs are currently green. Scope: tracker state only; no new runtime certification or deployment claim."
close_reason: "Re-verified unchanged main 27e1d84671fa: .github/workflows/pm-github-sync.yml, .github/workflows/pm-github-closeout.yml retain immutable reusable-workflow pins; runtime scheduled-job success is outside this closure. Audit delivery: Adopt pm-github 2026.10.16: default-branch-safe gated sync and daily gated closeout PRs. Both .github/workflows/pm-github-sync.yml and pm-github-closeout.yml pin 67a5e3e / 2026.10.16. Adoption is delivered; this does not claim scheduled jobs are currently green."
body: ""
Loading
Loading